Exam MS-102 topic 1 question 71 discussion

Data from Microsoft Defender for Endpoint is retained for 180 days, visible across the portal. However, in the advanced hunting investigation experience, it's accessible via a query for a period of 30 days. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/data-storage-privacy?view=o365-worldwide#how-long-will-microsoft-store-my-data-what-is-microsofts-data-retention-policy

It was 90 days but was changed in october to 180 days so make of that what you will

From Microsoft https://learn.microsoft.com/en-us/defender-endpoint/data-storage-privacy?view=o365-worldwide#data-retention Data Retention Data from Microsoft Defender for Endpoint is retained for 180 days, visible across the portal. Your data is kept and is available to you while the license is under grace period or suspended mode. At the end of this period, that data will be erased from Microsoft's systems to make it unrecoverable, no later than 180 days from contract termination or expiration. In the advanced hunting investigation experience, it's accessible via a query for 30 days

https://learn.microsoft.com/en-us/defender-endpoint/data-storage-privacy?view=o365-worldwide#data-retention Data from Microsoft Defender for Endpoint is retained for 180 days, visible across the portal.

https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention#:~:text=By%20default%2C%20data%20across%20different%20features%20is%20retained%20for%20a%20maximum%20of%2030%20days.%20However%2C%20for%20some%20of%20the%20features%2C%20you%20can%20specify%20the%20retention%20period%20based%20on%20policy.%20See%20the%20following%20table%20for%20the%20different%20retention%20periods%20for%20each%20feature.

90 Days https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention

Copilot: Alerts in the Microsoft 365 Defender portal are retained for 6 months (Option D). This retention period ensures that you have sufficient time to review and act on alerts.

6 MonthS

C The retention policy for alerts in the Microsoft 365 Defender portal depends on the type of alert and the service: Defender for Cloud: Alerts are displayed for 90 days, even if the related resource is deleted. Defender for Office 365 Plan 1: Alert metadata details are retained for 90 days, while entity metadata details for email are retained for 30 days. Activity alert details for audit logs are retained for 7 days. Microsoft Defender for Endpoint: Data is retained for 180 days, but advanced hunting data is only available for 30 days.

https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention

Just searched this online, says 30 days

Guys so which one?

For Plan 1 is 90, for Plan 2 is upto 6 months.

C is correct until the exam is updated. After that it is D. The English language version of this exam will be updated on April 26, 2024. Review the study guide linked in the “Tip” box for details on upcoming changes. If a localized version of this exam is available, it will be updated approximately eight weeks after this date.

Correct: D https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/alerts-queue?view=o365-worldwide On the top navigation you can: Customize columns to add or remove columns Apply filters Display the alerts for a particular duration like 1 Day, 3 Days, 1 Week, 30 Days, and 6 Months Export the alerts list to excel Manage Alerts

C is correct

"Alerts are displayed in the portal for 90 days, even if the resource related to the alert was deleted during that time. This is because the alert might indicate a potential breach to your organization that needs to be further investigated." - from: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview